Controlling Connections with Azure NSGs

软件技术 云计算
,
1

You are planning a strategy to deploy numerous web servers and database servers to Azure.

This strategy should allow for connection types between the web servers and database servers to be controlled.

Solution: You include network security groups (NSGs) in your strategy.

Does the solution meet the goal?

提供答案和解答

2025-10-09_09-46-38
2025-10-09_09-46-38780×724 127 KB

network security groups 是 Azure 内部的网络过滤筛选功能。

相关网络安全功能的定义和作用，请参考：Azure network security groups 概念和作用

2

Of course. Here is the answer and explanation in both English and Chinese.

English

Answer: Yes, the solution meets the goal.

Explanation:

Network Security Groups (NSGs) are the primary tool in Azure for controlling network traffic. They act as a stateful firewall to filter traffic to and from Azure resources in an Azure virtual network.

Here is how NSGs achieve the goal of controlling connection types between web and database servers:

  1. Rule-Based Filtering: NSGs contain a list of security rules that allow or deny network traffic based on the 5-tuple: source IP address, source port, destination IP address, destination port, and protocol (TCP, UDP, etc.).
  2. Tier Isolation: A common best practice is to place web servers in one subnet (e.g., a “Web Subnet”) and database servers in another subnet (e.g., a “DB Subnet”).
  3. Specific Control: You can then associate an NSG with the DB Subnet. In this NSG, you would create an inbound security rule that specifically:
    • Allows traffic.
    • From the source IP address range of the Web Subnet.
    • To the destination port used by your database (e.g., TCP port 1433 for Microsoft SQL Server or TCP 3306 for MySQL).

By default, an NSG includes rules that block all inbound traffic that isn’t explicitly allowed. This means that only your web servers on the specified subnet can communicate with your database servers on the correct port, and all other traffic (including from the public internet or other subnets) is denied. This perfectly accomplishes the goal of controlling the connections.

中文 (Chinese)

答案： 是的，该解决方案满足目标。

解答：

网络安全组 (NSG) 是 Azure 中用于控制网络流量的主要工具。它的作用类似于一个状态防火墙，用于筛选进出 Azure 虚拟网络中 Azure 资源的流量。

NSG 通过以下方式实现控制 Web 服务器和数据库服务器之间连接类型的目标：

  1. 基于规则的筛选： NSG 包含一系列安全规则，这些规则根据“五元组”信息（源 IP 地址、源端口、目标 IP 地址、目标端口和协议，如 TCP、UDP 等）来允许或拒绝网络流量。
  2. 分层隔离： 一种常见的最佳实践是将 Web 服务器放置在一个子网中（例如“Web 子网”），并将数据库服务器放置在另一个子网中（例如“DB 子网”）。
  3. 精确控制： 然后，您可以将一个 NSG 关联到 DB 子网。在此 NSG 中，您将创建一个入站安全规则，该规则明确：
    • 允许 (Allow) 流量。
    • 源 (Source) 为 Web 子网的 IP 地址范围。
    • 目标端口 (Destination Port) 为您的数据库所使用的端口（例如，Microsoft SQL Server 的 TCP 端口 1433 或 MySQL 的 TCP 端口 3306）。

默认情况下，NSG 包含拒绝所有未被明确允许的入站流量的规则。这意味着只有您指定子网中的 Web 服务器能够通过正确的端口与数据库服务器通信，而所有其他流量（包括来自公共互联网或其他子网的流量）都将被拒绝。这完美地实现了控制连接类型的目标。